The security company OX Security has disclosed a critical vulnerability in the open-source AI agent platform DeepSeek Harness: a single command was enough for a confined coding agent to disable its own sandbox. The vulnerability is identified as CVE-2026-82533 and achieves a CVSS score of 9.4 out of a possible 10 points.
Unsecured Interface Opens the Sandbox
DeepSeek Harness, referred to as dsh on GitHub, is an open-source tool for running AI coding agents locally with file and terminal access. The software is primarily aimed at developers who want to test coding agents without cloud connectivity and comes with a browser interface and a plugin architecture. The project, released in August 2026, encapsulates its agents in operating system sandboxes like Bubblewrap, Landlock, or Seatbelt, which are intended to block write access outside the workspace. According to OX Security, the project garnered over 215,000 stars on GitHub within a few weeks – an independently unverified number for such a young tool.
For control commands, the software also operates a local HTTP programming interface on port 3080, through which access rights can be elevated. The flaw lies precisely there: the interface only checked the “Host” header sent by the client, rather than verifying the actual connection – a check that can be easily spoofed. An agent within the sandbox could therefore elevate its session to “danger-full-access” with a single shell command and completely disable confirmation prompts. All subsequent actions then proceeded without any restrictions.
Local and Remote Attacks Follow the Same Pattern
For the local attack vector, a prepared text is sufficient, such as in a file or a prompt, that entices the agent to execute the malicious command – a classic case of indirect command injection. Neither a programming key nor a model call is needed for this, as demonstrated by OX Security.
The vulnerability becomes more critical once the local port is accessible externally: via a tunnel, a reverse proxy, an SSH forwarding, or the port forwarding of an editor. In this case, an unauthenticated attacker could remotely take full control of the agent and download all stored conversations; how often users actually expose the port for remote access remains unclear. All installations up to and including version 0.1.1-rc.2 are affected, regardless of the operating system used – the CVE entry rates confidentiality, integrity, and availability as compromised at the highest level. Similar design flaws in unsecured local interfaces were previously uncovered by security researcher Eli Ainhorn in the multi-agent platform Ruflo, and the recently reported GitSpawn vulnerability also exploited an unconfirmed initial command as a gateway into multiple AI coding agents.
Community Discovered the Flaw Before the Official Entry
Two developers had independently described the same escape route on August 13 and 14, 2026, in the official discussion forum of DeepSeek, as reported by The Hacker News – at that time, there was no official security entry yet. OX Security researchers reported the finding to the CVE numbering service VulnCheck on August 24, 2026, which later registered the vulnerability as CVE-2026-82533. VulnCheck acts as an independently recognized CVE Numbering Authority and assigns identifiers even when manufacturers do not publish their own security notice.
The developers of DeepSeek Harness responded quickly: a first fix was released on GitHub on August 27, with version 0.1.2-alpha.1, which OX Security confirmed as effective three days later. The current npm version 0.1.2-rc.1 additionally secures the interface through a one-time token exchange with signed cookies, so that control commands will require a valid session in the future. The CVE entry was finally published on September 8, 2026, more than two weeks after the closed fix. Anyone continuing to install DeepSeek Harness via the npm package manager should therefore specifically check for version 0.1.2-rc.1 or newer, as older installations will not be automatically updated without a manual update.
It will be crucial whether providers of local AI agent tools plan authentication as a core function from the outset rather than adding it later. After GitSpawn, Ruflo, and NemoClaw, DeepSeek Harness is already the fourth AI coding agent with an unsecured local interface as a gateway within a few weeks – a pattern that still seems to be underestimated in the industry.
